1

I'm testing redirecting programs std_out to /dev/stdout in docker alpine. I can't figure out why I can echo from user to stdout, but not from su command.

docker exec -it 779ddea6ec33 bash # root user

bash-4.4# su - http -c "echo 1 >> /dev/stdout"
-sh: can't create /dev/stdout: Permission denied 
# why comman above failed
bash-4.4# whoami 
root
bash-4.4# su - root -c "echo 1 >> /dev/stdout"
1

docker exec -u http -it 779ddea6ec33 bash # http user

bash-4.4$ whoami 
http
bash-4.4$ echo 1 >> /dev/stdout
1
# but this command works

some ls:

bash-4.4# ls -lad /dev/stdout 
lrwxrwxrwx    1 root     root            15 Jul  7 16:47 /dev/stdout -> /proc/self/fd/1
bash-4.4# ls -lad /proc/self/fd/1
lrwx------    1 root     root            64 Jul  7 18:09 /proc/self/fd/1 -> /dev/pts/0
bash-4.4# ls -lad /dev/pts/0 
crw--w----    1 root     tty       136,   0 Jul  7 18:09 /dev/pts/0

stat:

bash-4.4# stat /dev/stdout
  File: '/dev/stdout' -> '/proc/self/fd/1'
  Size: 15              Blocks: 0          IO Block: 4096   symbolic link
Device: 4dh/77d Inode: 8013573     Links: 1
Access: (0777/lrwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2019-07-07 18:09:33.000000000
Modify: 2019-07-07 16:47:08.000000000
Change: 2019-07-07 16:47:08.000000000

bash-4.4# stat /dev/pts/0
  File: /dev/pts/0
  Size: 0               Blocks: 0          IO Block: 1024   character special file
Device: 4eh/78d Inode: 3           Links: 1     Device type: 88,0
Access: (0620/crw--w----)  Uid: (    0/    root)   Gid: (    5/     tty)
Access: 2019-07-07 18:15:28.000000000
Modify: 2019-07-07 18:15:28.000000000
Change: 2019-07-07 17:48:22.000000000
10
  • You're trying to open a file for writing (a special file, but a file nonetheless), that's owned by another user and probably doesn't have write access to everybody. What did you expect?
    – muru
    Jul 7, 2019 at 18:03
  • That doesn't explain why it doesn't fail in the 2nd case. Jul 7, 2019 at 18:05
  • What's to explain there? You're opening a file that's owned and writable by you.
    – muru
    Jul 7, 2019 at 18:06
  • In both 1st and 2nd cases, it's not owned by me. Why it doesn't fail in 1st case? I don't own that file in 1st case. I run the command from http user. Jul 7, 2019 at 18:08
  • How do you know it's not owned by you? Have you ran stat on it?
    – muru
    Jul 7, 2019 at 18:08

1 Answer 1

1

/dev/stdout is a special file.

Lets say I'm logged in with two user (user1 on tty1 and user2 on tty2).

/dev/stdout for user1 refers to /dev/tty1 and for user two refers to /dev/tty2.

Here http user is trying to write something on /dev/stdout which belongs to current user (root):

bash-4.4# su - http -c "echo 1 >> /dev/stdout"
-sh: can't create /dev/stdout: Permission denied 

In the other case http is writing to a file which it owns.

3
  • It's not the writing that's the problem - it's trying to open it again for writing (via redirection). It already has an inherited fd to the same file that it can write to without problems.
    – muru
    Jul 7, 2019 at 18:32
  • If it is possible for you I would love to see a complete answer on this question ...
    – Ravexina
    Jul 7, 2019 at 18:33
  • This is answer is fine, just correct that bit.
    – muru
    Jul 7, 2019 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .